RomaniaOrdonanța de urgență nr. 140/2021, Updates and Security Updates for Goods With Digital Elements
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2026. Publisher's page: https://legislatie.just.ro/Public/DetaliiDocumentAfis/250044In force since .
A product security requirements rule binding private bodies.
- Obligation class
- Security, Disclosure
As of .
What it requires
- If you sell goods with digital elements to a consumer in Romania, ensure that the consumer is informed about updates and is supplied with the updates, including security updates, needed to keep the goods in conformity, for the period the consumer can reasonably expect where the sale contract provides a single act of supply of the digital content or service (Article 6(3)(a)).NIST CSF 2.0PR.PS-02
- Where the sale contract provides continuous supply of the digital content or service over a set period, supply those updates for the periods in Article 9(3) and (4): two years from delivery for goods with an average period of use of up to five years, five years from delivery for goods with a longer average period of use, and the contractual supply period where it exceeds five years (Article 6(3)(b)).NIST CSF 2.0PR.PS-02
- Supply goods with the durability, functionality, compatibility and security that are normal for goods of the same type and that the consumer can reasonably expect (Article 6(1)(d)).NIST CSF 2.0PR.PS-06
- Tell the consumer that an update is available and what follows if it is not installed, and give installation instructions without deficiencies, to rely on the consumer's failure to install it (Article 6(4)).NIST CSF 2.0PR.PS-02
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST CSF 2.0
- CIS Controls
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
1 more
- AIR-DET-001AI Data Leakage Prevention and Detection
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Criminal exposure note
The sanctions in Article 18 are contraventions punished by administrative fine; the ordinance creates no criminal offence.
Penalty structure
Fine for the contravention in Article 18(1)(b); Article 18(3) and (4) set the same range for repeated and for serious repeated breaches.
- Rule
- Fixed only
- As of
- Minimum
- 5,000
- Currency
- RON
- Fixed cap
- 25,000
Who enforces it
Enforcement body
Autoritatea Națională pentru Protecția Consumatorilor (National Authority for Consumer Protection), whose authorized representatives find the contraventions and apply the sanctions (Article 18(5)).
Settledness
- As of
What this law does
Government Emergency Ordinance 140/2021, published in Monitorul Oficial issue 1245 of , sets the rules for sale-of-goods contracts between a seller and a consumer and transposes Directive (EU) 2019/771. Article 20(1) brings the ordinance into force on , except Article 18 on sanctions, which enters into force within 10 days of publication in the Monitorul Oficial. Article 20(4) applies the ordinance to contracts concluded after .
Article 6(3) requires the seller of goods with digital elements to ensure that the consumer is informed about updates and is supplied with updates, including security updates, that are needed to keep the goods in conformity.
Where the sale contract provides a single act of supply of the digital content or digital service, Article 6(3)(a) runs the update duty for the period the consumer can reasonably expect, given the type and purpose of the goods and digital elements and the circumstances and nature of the contract. Where the sale contract provides continuous supply of the digital content or digital service over a set period, Article 6(3)(b) runs the update duty for the periods set in Article 9(3) and (4).
Article 9(3) and (4) make the seller answerable for a non-conformity of the digital content or service for two years from delivery for goods with an average period of use of up to five years, for five years from delivery for goods with a longer average period of use, and for the whole contractual supply period where the contract provides continuous supply for more than five years.
Article 6(4) relieves the seller of liability for a non-conformity caused only by the lack of an update that the consumer did not install within a reasonable time, if the seller informed the consumer of the update and the consequences of not installing it and the failure was not caused by deficient installation instructions.
Article 6(1)(d) requires goods to have the durability, functionality, compatibility and security that are normal for goods of the same type and that the consumer can reasonably expect. Article 18(1)(b) punishes non-compliance with Article 4, read with Article 6(1) and (3), by a fine of 5,000 lei to 25,000 lei.
Under Article 18(5), the authorized representatives of the National Authority for Consumer Protection (Autoritatea Națională pentru Protecția Consumatorilor) find the contraventions and apply the sanctions.
When LexLint raises it
When your app profile says your app distributes a software product or ships a mobile app.